Cloudflare DNS: Enable proxying for all records isn't always respected

[iliajie]

Hello Jamie!

If the template is configured to “Create new DNS zones on” as “Local files” and “Enable proxying on new records” is set to “For all records,” after a new domain is created and switched to use Cloudflare DNS via the “DNS Settings ⇾ DNS Options” page, the proxying for all records is not enabled despite the template configuration.

[jcameron]

Hmmm ... I wonder if that's actually what we want though? It could be very surprising to users, as it would effectively change the IP addresses of those records as seen from the internet.

[iliajie]

In this case, DNS is switched from local to Cloudflare, and since the records are being created anew, I think they should follow the template rules and enable proxy if the template says so. It’s actually more surprising if they don’t.

[jcameron]

They aren't really new records though, we're moving them across from local

[iliajie]

It could be very surprising to users

They aren't really new records though, we're moving them across from local

Proxying is unique to Cloudflare, and users might be surprised if a template suggests the records are proxied but they aren’t, potentially exposing IP addresses. This is especially concerning for those who specifically wanted proxying from the start.

[iliajie]

↑

[jcameron]

No I think the current behavior is correct - the template generally applies only to new domains.

[iliajie]

Yes, but features enabled at a later time are also designed to use templates, and they do—this includes configured options on the “Server Templates: Edit Server Template / DNS for domain” page. For instance, the "BIND DNS records for new domains” option, when set to “Records below ..", consistently adds custom records to the zone, whether during domain creation or after the feature was initially disabled and then later re-enabled. And, this is great—clear and straightforward.

The same should apply to the “Enable proxying on new records” option to avoid confusing users with inconsistent behavior...

[jcameron]

In this case though the user isn't really enabling a feature, just changing the config to use a different DNS provider. In my opinion it would be surprising and potentially cause breakage to switch to proxying, because that's a whole different behaviour and feature in Cloudflare.

[iliajie]

I understand your position better now—thank you for clarifying! Yes, I agree that it would change the previous behavior. I think then we’re fine as long as we take template configurations into account for proxy options when toggling the DNS feature after a domain has been created.

[jcameron]

What we could do maybe is add a button to enable proxing for all records per the template with a single click..

[iliajie]

What we could do maybe is add a button to enable proxing for all records per the template with a single click..

Nah, I think we’re good. I don’t believe there’s a need to clutter the UI for edge case scenarios.

Thank you!